Outdated Aztec smart contract drained: hacker withdraws $2.1 million due to verification error
My analytical systems have detected a serious incident in the Aztec Network ecosystem. An attacker successfully exploited an outdated smart contract of the Aztec Connect platform, withdrawing approximately $2.1 million in cryptocurrency. The attack was carried out through a transaction that bypassed standard security checks.
The incident specifically affected Aztec Connect, a solution for private DeFi transactions that was officially discontinued back in 2023. Despite the Aztec Labs team ceasing support for this protocol, a significant portion of funds remained locked in its infrastructure. It is important to emphasize: the current Aztec Network and user assets within it were not affected.
Root of the Vulnerability: Mismatch in Verification Logic
Specialists from BlockSec conducted a preliminary analysis and identified the key issue. The attack was made possible due to a fundamental mismatch between transaction verification at the smart contract level and their actual settlement in the base Ethereum layer. The attacker exploited the difference in how the verification path and operational logic interpreted the transaction list. As a result, the contract could credit the value of assets without their actual verification on the L1 blockchain. Simply put, the hacker created unbacked balances and withdrew real funds.
According to CertiK monitoring data, the stolen assets included: 909 ETH, 270,000 DAI, 167 wstETH, as well as a number of other cryptocurrencies. The attack was carried out across seven different assets, indicating the attacker's deep understanding of the protocol's internal architecture.
Background and Team Position
Aztec Connect was launched in 2022 as a private DeFi bridge. In March 2023, the team stopped accepting deposits, fully shifting resources to developing Aztec Network. The developers stated that they do not have administrative keys to the outdated contract and cannot pause or upgrade it—the contract was inherently immutable. This is a classic example of the risk associated with "dead" or abandoned smart contracts that continue to hold funds.
My comment as an analyst: This incident is a stark reminder that "dead" protocols are not safe. Any smart contract with liquidity, even if unsupported, remains a target. Investors and project teams need to develop mechanisms for safely withdrawing funds from outdated contracts before ceasing their support. Ignoring this rule inevitably leads to financial losses sooner or later.